Consolidation is nothing new in the VPN world. Today, the spotlight is on Surfshark merging with Nord Security, which is the parent company of NordVPN.
NordVPN and Surfshark are both leading VPN services. For years, we have noted the similarities between these VPNs, particularly with regards to features and performance. Looking forward, it does not appear that much will change, especially since Surfshark and Nord Security will both continue to operate independently.
Back in October 2021, we saw Surfshark relocate to The Netherlands, perhaps in preparation for the upcoming merger. Under this new merger agreement with Nord Security, the resulting company will be called Cyberspace and it will operate under the jurisdiction of The Netherlands, where Surfshark is already based.
Looking ahead, it does not appear that there will be any major operational changes. Both Nord Security and Surfshark will continue to operate independently of each other. Additionally, there will be no shared infrastructure or product development plans.
In a joint press release today, the founder of each VPN provided comments on the situation of Surfshark merging with Nord Security:
The increasing complexity of cybersecurity and digital privacy is a growing challenge worldwide. We believe that this industry requires radical simplification and ease of access, both for consumers and businesses. Together, Nord Security and Surfshark create the largest internet security powerhouse in the market, ready to bring advanced solutions for customers.
-Tom Okman, co-founder of Nord Security
Consolidations in the global consumer cybersecurity market indicate the industry’s maturity. They also bring new competitive challenges. Nord Security and Surfshark joining forces will set the ground to scale in different digital security dimensions, which is necessary to meet the growing requirements of our customers.
– Vytautas Kaziukonis, founder of Surfshark
The press release provided to RestorePrivacy offered additional details on what the future looks like.
The idea behind the deal is to streamline resources towards common goals while preserving the autonomy of both companies. Founders highlight that this strategic business move will serve as a springboard towards more rapid development and innovation while maintaining the uniqueness of both brands that customers learned to appreciate over many years.
The merger will solidify both companies’ offerings in different market segments and diversify the geographical reach. Both companies will continue to focus on developing distinct solutions to cover various areas of cybersecurity, among which are personal data protection, device security, file security, and others.
More cybersecurity tools with NordVPN and Surfshark
When you look strictly at the VPN services themselves, there are many similarities with Surfshark and NordVPN. But taking a broader examine at each business, we see something else.
Both Nord Security and Surfshark offer a diverse array of cybersecurity tools, beyond just a VPN.
Nord Security offers:
- NordVPN, the flagship VPN product
- NordPass, a password manager
- NordLocker, a file encryption tool and cloud storage service
Meanwhile, we see that Surfshark also offers a variety of products:
- Surfshark VPN
- Surfshark Search, a private search engine
- Surfshark Alert, a data breach monitoring tool
- Surfshark Antivirus
Both Surfshark and NordVPN also offer the ability to bundle services together for more savings. Perhaps this merger under Nord Security will better position each product to offer additional security and privacy tools for a growing number of needs and use cases.
This is one area where both Surfshark and NordVPN stand out from other VPN services. Both companies are ambitious and innovative in offering an array of products, tools, and solutions for their users, beyond just a VPN.
Further consolidation in the VPN industry
Just a few months ago I wrote about another major buyout in the VPN industry when Kape Technologies purchased ExpressVPN. In that article I noted that many VPN brands now fall under the control of Kape Technologies:
Similar to the situation with Surfshark, we have learned that ExpressVPN will also continue to operate independently, despite the acquisition by Kape.
Note: We also published an investigation on the history of Kape Technologies (formerly Crossrider). While Kape/Crossrider has often been associated with malware, the truth is that it created a development platform that was later used by third party malware distributors (outside of Crossrider's control).
Additionally, we see that the Ziff Davis group (formerly j2 Global) also owns a large VPN and cybersecurity portfolio that includes:
- IPVanish
- StrongVPN
- Encrypt.me
Is consolidation in the VPN market a good thing?
Ultimately, there are pros and cons to everything. An obvious con, and a problem I have pointed out before, is that there are fewer independent VPNs for consumers to choose from.
However, an advantage to the situation might be long-term stability. In other words, with a large organization backing the VPN, it is less likely to shut down or cease operating. However, we do see that the Ziff Davis group has announced plans to shut down Encrypt.me and combine it with StrongVPN.
In the case of Surfshark and Nord Security, both companies have been ambitiously rolling out new privacy and security solutions over the past few years. This merger may help both companies to continue in that direction of innovation and broadening their cybersecurity offerings.
Hi Sven,
I have noticed that NordVPN has added a new feature called “Threat Protection.”
It is stated that it is in beta.
It states the features are “Block malware-ridden websites,” “Stop web tracking,” “Avoid malicious ads” and “Protect your device from infected files.”
The information (from NordVPN) states, “Sometimes, the initial scan can’t tell if a file is safe. To give you comprehensive protection, the app then uploads the file to the cloud where it runs a deep scan for advanced malware detection. Deep scan applies only applies to executable files, so no personal data is processed.”
The “deep-scan (recommended)” is an option.
I was going to activate the service / feature on the belief that if I am trusting as Nord as a VPN provider I may as well trust there other products.
(The was nothing said about additional charges.)
When completing the activation Nord notified me that, “It looks like you have another antivirus program running on your computer. It might prevent Threat Protection from working as expected. Continue anyway”?
At this point I backed out of the activation.
I wonder what your thoughts my be?
My thoughts are:
– that it usually a bad idea to run two AV applications on one device. That they can potentially detect each other as potentially malicious and attempt to block each other and/or in critical situations may fight for system resources that both require.
So I don’t believe it a good idea to run two.
– that I really would prefer to rely on Windows Defender as it is broader in spectrum as a anti-malware application (and is not in beta).
– has Nord developed (is developing / offering) it’s own technology or have they partnered with another provider? Or acquired a AV company?
– why would I (as a user) chose an external AV over the Windows native AV?
– i like the idea of using cloud resources for AV analysis but what actions would the Nord application take if it found and executable to be malicious? What would it do if Windows was already addressing the issue?
My conclusion is:
– That Nord may have mis-stepped here…
– That they are offering a new service (beta) (prompted from the Nord dashboard – promoting to all users) where they have not made enough effort to inform users of the implications of a service that they recommend.
– In your RP article on the Nord – SurfShark merger (excuse me for not going back over that article in detail) the information was in part ~”wanting to become a larger security focused company.”
– I am concerned here by Nord’s steps undertaken.
Thank you for reading my views and concerns;
But I am not an expert.
As a RP reader I would appreciate your views on the matter.
Regards,
BoBeX
P.S. Please note, I have been using NordVPN for towards 6 months and am a very satisfied customer.
Hi BoBeX, to be honest, I have not had time to closely examine/test/review the Threat Protection feature. I’m also wondering why they needed to add this feature given that NordVPN already has the CyberSec feature that blocks ads, trackers, and malware domains. Anyway, I can’t offer much insight until looking into it more…
Hi Sven,
Looking around the web it hard to find anyone who has thoroughly tested the feature. This makes sense as it is in beta. What could be said, “I found a bug,” or “doesn’t work entirely as expected.”
I found two articles which give some insight into Nord’s thinking which I will add at the bottom.
My summation is that Nord may have one or two goals in mind:
– That is simply to leverage their brand to enter the AV market, maybe with some differentiation via scanning for malware in the cloud, which would be an interesting idea.
– Another possibility is that the end goal is to create a product that performs a function similar to an AV that can be deployed at the edge of a network, but surely this would require appropriate hardware.
– Maybe a hybrid model combining both ideas?
But I don’t know.
Their product makes no sense in my use case.
The only functionality that I find appealing is scanning files for malware in the cloud. That would really appeal to me. Functionality like VirusTotal in the cloud sounds like a great idea. But the current Nord implementation is very limited.
I am going to pull on quote from the articles linked below as it addresses one of my key concerns raised in my original post:
“Still, although Threat Protection might not replace your antivirus, it will almost certainly run alongside it without causing any conflicts.”
I mention this only for fairness.
Regards,
BoBeX
https://www.techradar.com/vpn/nordvpn-threat-protection
https://au.pcmag.com/antivirus/92360/nordvpn-to-offer-antivirus-through-built-in-threat-protection-feature
Thanks for the additional info!
Not related but could you also consider doing a review of DNS server providers (e.g. 1.1.1.1. by Cloudflare, Quad9 etc.)? (especially regarding Nordvpn cuz ipleak.com always shows different DNS servers compared to what NordVPn states on thier webiste)?
When you use a VPN, you are using the VPN’s secured and encrypted DNS servers, as is the case with NordVPN, which passed all of the leak tests we put it through. I do not recommend using third-party DNS servers like Cloudflare for many reasons, but mainly they are probably logging all DNS queries (your browsing history). If you are using a good, trustworthy no-logs VPN service, there is no need to use a third-party DNS, and you also (probably) shouldn’t as this could cause DNS leaks. If you aren’t using a good VPN, you should be when ISPs log everything. A third-party DNS is no substitute and will not even hide your IP address when you go online, or prevent your ISP from logging the websites you visit.
If you like, you can try DNS service by some of the reputable privacy companies, like AdGuard DNS. It has the ability to block ads and trackers on DNS level. It’s absolutely free and you can use it alongside VPN, very efficient.
On another note, please review cryptostorm.is which seems to be a good provider.
Hi odinaiodbasoidasbodöb
Could you give a quick run down on why you suggest / recommend the service?
I don’t think it matters all that much if good companies merge & it comes at the cost of a bit of competition. Fundamentally, if it makes their service stronger, than that’s good for consumers.
I think what matters most is whether there is strong management, that’s committed to it’s true purpose & can balance that against profit. When I look at a company like Kaspersky “VPN”, that claims “no-logs”, but because it had a large customer base in Russia, agreed to the Russian governments demands for access to client data. so…how could they & others I don’t need to mention, be trusted? How can we trust, either present or future, that companies with large networks in countries such as Australia, UK etc, won’t bend to the demands for “assistance”, simply because they have a large subscribing base in that country? Who could blame them?
Nothing like a principal when it costs nothing & small VPN provider would have a harder time fighting something in court than a larger one with the resources behind it to defend itself & it’s mission.
Eventually there will be two or three big (giant) VPN companies left. And then the prices will go up considerably, because then it’s about more profit instead of privacy and security.
The same is going on with Internet providers and there you already see the absurd price increase.
The only reason internet prices have gone up is because the commodity prices that relate to it have gone up considerably in the past year.
As long as Surfshark and Nord VPN remain independent regarding their location, and privacy policies. However, I have noticed that some companies upon merger revamp their privacy policies in terms of logging or otherwise. I hope that their policies stay the same but one never knows. It is when they change these policies that defeats any semblance of privacy for the user.
Sven in your revealing article there is no mention by the CEOs in regard to these important points other than the merger and continued independence as separate entities.
Corporations, corporations… All they want is to get bigger and bigger, more income and more power. I don’t know about you, but I hate using this type of products for privacy purpose. Surfshark used to be good, but I don’t like these directions. I think Mullvad or IVPN will be my next VPN service.
On market place diversity…
I am much more concerned about web browsers.
That is not to say there isn’t a lot of them;
But they are increasingly Chromium based and there is fewer FF forks that are maintained and done well.
Just my oppinion
On the whole, this sounds like good news to me.
Where consolidation is necessary who else would I be happy to see either merge with?
They could have partnered with a data sales or advertising company.
I think these guys sound really smart. With security and privacy products customer trust is paramount, on my part being a customer, my trust is not diminished at all. I view it that I now have a second set of eyes looking after my security and privacy.
I really hope they can make this work.
I also like the the founders of these two company’s are still significantly involved (assumed on the basis that they are making the press statements)
What I don’t like about mergers, acquisitionsetc is that the mission, culture, purpose of an organisation can change.
Here the founders are still in charge (assumed). If they believe they can do better together than individually, I wish them the best.
In a big hit to privacy principles, uBlock Origin detected gTagManager and gAnalytics on some of the mentioned VPN web sites. The fear is the data-mining also occurs within subscribers local vpn client software.
The closed-source program could transmit pseudo-anatomized tracking data to the partners mothership. This circumvention technique renders VPN providers no-log claim to be a red-herring.
How about a future article Sven? I’m sure there is widespread interest!
I’ve addressed this before, and this is not “data mining” but rather marketing to acquire new customers. And without acquiring customers, the VPN may go out of business. So gTagManager and gAnalytics are for the website only for marketing purposes and managing ad campaigns. Without these tools, you can’t advertise on the large platforms and track what you are doing. Similarly, some mobile apps have these tools integrated for marketing purposes, but you can disable them in the settings.
It seems that Surfshark bought NordVPN. The headquarters will be in the Netherlands where the Surfshark HQ is.
My bigger concern is that the Netherlands is a Nine Eyes country. Can the Dutch government force the new company to spy on Surfshark and Nord clients? Remember that the Swiss government forced ProtonMail to collect and remit data on their clients. And Switzerland is one of the “safe places”.
Sven, I hope you will address this in your VPN reviews and rankings.
Thanks.
No, it was a merger between Surfshark and Nord Security. NordVPN will continue to operate independently with its jurisdiction remaining in Panama, from everything I can see/research.
An email service is VERY different from a VPN when it comes to logging. I would not have any concerns over The Netherlands jurisdiction, which I discussed more in the guide on 5 Eyes here.
Dear Lord, more VPN consolidation, less competition, less choice for the consumer. This can’t be good news. Who knows what happens behind closed doors in these companies.
Is it possible they will share each others infrastructure for better stability and sven Taylor please review brave search engine is it safe or not
No there is no shared infrastructure, as noted in the article.
I don’t see the point of Nord buying Surfshark but to take their databases and client lists 🤔
Exactly.
The parent company clearly gains access to the subsidiary’s data. And it appears to be Surfshark absorbing Nord.
Furthermore, if Surfshark incorporates Nord, and it is based in Netherlands, how can we trust that Europol or other EU agencies cannot legally leverage disclosure (of joint data)?